Privacy Policy

1. Data we process

• Account data: user ID, username, display name, avatar, role, email, and authorized Telegram ID, username, and avatar.
• Transaction data: orders, products, amounts, currencies, status, public order numbers, reviews, support cases, and seller ledger entries.
• Payment data: network, public transaction hash, receiving address, received amount, and verification result. We do not hold wallet private keys or seed phrases.
• Optional GPT status check: only after explicit consent, the submitted Session/access token is encrypted in transit, held in server memory for the duration of one live status query, and then discarded. It is not written to the database, cache, analytics, backups, audit records, or application logs. Only sanitized status fields are returned to the signed-in user.
• Security data: necessary access, rate-limit, audit, error, and device information. Sensitive inventory is encrypted and logs must not record full delivery content.
• Content you submit: products, images, descriptions, support requests, and communications with MaplePass.

2. Why we use it

We use this data to create and protect accounts, process orders and payments, allocate inventory atomically, display delivery content, send notifications, calculate seller ledgers, review products, handle refunds and disputes, prevent fraud, meet legal obligations, and improve reliability. Sign-in and transaction data is not used for unrelated secret profiling.

3. Providers and public networks

To operate MaplePass, data may be processed by Supabase (database and authentication), Vercel (hosting and functions), Cloudflare (domain, security, and scheduling), Telegram (sign-in, bot, groups, or channels), and the selected payment network or provider. Blockchain transaction hashes, addresses, amounts, and times may be permanently public and cannot be removed from a public chain by MaplePass.

4. What is public

Seller store names, products, ratings, and public reviews are visible to visitors. Email addresses, Telegram IDs, order details, payment-verification records, and full delivery content are private by default. Buyers can read only their own deliveries; sellers and support staff access only what their role requires.

5. International processing

The cloud providers, Telegram, and blockchain nodes above may process data outside your country or region. We select processing based on service functionality, contractual safeguards, and applicable law, but data-protection rules differ by region.

6. Retention

• GPT status-check Session/access tokens are not retained: they are discarded from server memory when that single request finishes and are excluded from storage and logs.
• One-time sign-in and linking tokens expire quickly and become invalid after use.
• Routine security and rate-limit records are kept only as needed for investigation and abuse prevention, with longer retention during an incident.
• Account data is retained until deletion or until no longer needed to provide the service; Telegram links remain until unlinking or account deletion.
• Orders, payments, seller ledgers, refunds, and audit records are retained as needed for fraud prevention, tax, accounting, disputes, and legal obligations.
• Production backups are currently encrypted and retained for 14 days, then automatically deleted. Public blockchain records are not controlled by this period.

7. Your choices and rights

Depending on local law, you may have rights to access, correct, export, delete, restrict, or object to processing, withdraw consent, or complain to a regulator. Account deletion does not necessarily remove records that must be retained for law or transaction disputes; their use will be limited. We may verify a request through an existing sign-in channel, but never ask for passwords, verification codes, sessions, or wallet private keys.

8. Cookies and sign-in state

MaplePass uses cookies or local storage necessary for sign-in, security, and language/theme preferences. We do not currently use third-party advertising-tracking cookies. If optional analytics or advertising are introduced later, this notice will be updated and consent choices provided where required.

9. Security and children

We use access controls, row-level security, encryption in transit, inventory encryption, signature verification, rate limits, and audit logs, but no online service can guarantee absolute security. MaplePass is not intended for children below the legal age to contract where they live. Contact us if you believe a child’s data was submitted without appropriate authorization.